Verified, Attested, Handed Off
The first version of our sign-in debugging view showed a complete set of claims for every session: a verified email, a trusted user, a sign-in time two minut...
Posts by Year
2026
We Said “What Is Not Attested Is Not Real.” Here Is the Run.
deployment_signed: false slsa_verified: false supply_chain_score: 0.2
Quiet Is Not Health
Our model for judging a whole population of agent decisions was rigorous. Its mathematics had been reviewed twice, and every number it produced could sit ins...
The Doctrine Was the Easy Part
The last series ended in August on a sentence about posture: the disposition the discipline asks of the practitioner. Thirteen weeks of doctrine. What an age...
A Record for Every Attempt
The reference deployment first ran in a production project in observe mode. The run finished with zero errors. Every act the deployment exists to show, inclu...
What May Sit in the Hot Path
The team is building its own decision point for agent traffic: a small service that a load balancer calls on every request to an agent or tool we own, and wh...
The Agents Carry the Gateway
The plan was to put the gateway at the front door. Users reach the agents through an assistant app, and the app can be bound to a managed gateway, so every r...
Govern Where You Own the Destination
The plan fit on one page. A gateway in front of every agent, a policy surface for every hop, one place to write the rules. It is the picture most agent-gover...
The Standing Posture: What This Discipline Asks of Us
This is the final post in a thirteen-week arc. The arc moved through five rings: the frame (Trust × Safety, Position B, the bleed zone), the inheritances (ve...
What Conventional Security Got Right (and Where It Stops)
There is a temptation in agentic security writing to position conventional security as the thing being replaced. The old model is broken; the new model fixes...
Phase 0 Is the Floor, Not the Ceiling
Most maturity models are climbing models. You start at level 1, do specific work, get to level 2, do more work, get to level 3, and so on. Each level builds ...
The Six Essentials: 60% Coverage in One Sprint
A team is starting from zero. They have agents in production, no specific Zero Trust framework in place, a security org that has covered conventional infrast...
Trust Is a Computation, Not a Property
The most-overheard conversation in agentic security:
The Question a CISO Should Ask Before Adopting Agents
A board asks the CISO: we want to deploy AI agents across our customer service operation. What do we need to do?
Recoverable Failure: The Forensic Ledger as Posture
A team’s agent fails in production. They go to investigate. The agent ran for three minutes, made forty-seven decisions, took twenty-three actions, produced ...
Bounded Action: Why Refusal Is Not Free
A team builds a policy engine for their agent. The policy is conservative. Anytime the agent’s planned action falls outside a narrow allow-list, the engine r...
Authority Is Not the Same Thing As Identity
A team builds an agent. They invest heavily in identity: workload identity, federated tokens, signed registration, attested binding. The agent’s identity is ...
What Is Not Attested Is Neither Real Nor True
There is a foundational claim at the centre of agentic Zero Trust:
Capability Floors and the Consequentiality Axis
A team operates a Phase 2 organisation. They have identity controls, basic supply chain verification, behavioural baselines, output validation. They feel rea...
The Closure Pattern: Trust Pillars × Safety Facets, Per Item
A team is auditing their agentic system. They have a spreadsheet. The columns are the controls they have shipped: identity verification, supply chain attesta...
Lesson > Artifact: Why We Write Parables at All
A team builds a framework. They write the technical exposition: precise, systematic, complete. The exposition is correct. Engineers can implement from it. Th...
The Wall, the Mountain, and the Whetstone: Three Parables on Inheritance
There is a temptation in technical work to tell the story as if it begins with you. The framework is yours; the architecture is yours; the discipline is your...
The Seed and the Banyan: How a Framework Generates a Tree
A man visits an old garden. At the centre is a banyan tree. The trunk is wider than three men’s outstretched arms. Roots descend from branches, find the grou...
The Kitchen, the Well, and the Boat: Phase 0 in Three Stories
There is a habit, in technical writing, of explaining the framework first and showing the application second. The framework comes with definitions, decomposi...
The Gyroscope, Not the Wall
A team builds a defence around their AI agent. Threats emerge: a new prompt-injection technique, a new model-capability frontier, a new supply-chain compromi...
The Sūtra and the Bhāṣya: Why the Layered Architecture Holds
A team builds a Zero Trust framework for AI agents. They write a long document. They keep adding sections. New threat? Add a section. New control? Add a sect...
Process Safety Has Always Known This
When the agentic-systems community talks about “AI safety,” we talk like we are inventing the discipline. We are not. We are receiving it.
The Vitality Triad: Why Three Pillars, Not Two or Four
The framework names a Vitality Formula: the engineered outcome of an agentic system, the experienced fruit of trust and safety done right. The formula has a ...
Six Means of Knowing: Why One Channel Is Never Enough
How do you know what an AI agent’s output is actually true?
Verification, Not Prevention: Posing the Tractable Problem
Conventional security promises prevention. The discipline tries to stop bad things from happening: block the input, patch the bug, eliminate the vulnerabilit...
The Bleed Zone: Where Competence Becomes Safety
There is a clean version of the Trust × Safety frame that says: trust is built from competence and character; safety is built from alignment, resilience, and...
Position B: Why Safety Is Bigger Than Security
In conventional thinking, safety is a subset of security. You harden the system; harm doesn’t land. Secure is safe is the implicit mental model.
The Useless Bureaucrat: When Refusing to Act Is the Failure Mode
There is a tempting failure mode in agent design. The agent is asked to do something. The instruction is mildly ambiguous. The context is incomplete. The rig...
Trust × Safety: Why the Multiplication Matters
A team builds an AI agent. They invest deeply in trust: the agent’s identity is verified, its supply chain is attested, its behavior is profiled, its outputs...
Orthogonal to Each Other, Not to the World
A reviewer reads a Zero Trust framework. The framework claims its evaluation dimensions are orthogonal. The reviewer pushes:
Forcing Functions Don’t Make Seams — They Make Them Visible
A team is evolving their framework. They add a new constraint — a regulatory requirement, a new threat class, a new product surface, a new dimension of evalu...
Naming What Already Exists: PDP/PEP Was the Rule Pipeline Read Correctly
A team is evolving an agentic Trust framework. They have built it for some time. The framework computes verdicts; the verdicts gate actions; the system works.
Capability Floors: Why Your Model Sets Your Security Posture
A Phase 2 organization deploys a frontier model. They have identity controls, basic supply chain verification, and competence testing. They feel ready.
From Black Box to Glass Box
Your agent spent $4,200 at 3am. The CISO has five questions. You have until the morning standup to answer them.
From Trust Us to Verify It Yourself
Every AI platform today makes the same claim: “We are secure. We are safe. We are trustworthy.”
The 3am Problem
It is 3:14am. Your purchasing agent detects that printer paper is running low — 15 units against a 50-unit threshold. It places a reorder. $50,000 spent. No ...
Policy Is a Promise. Architecture Is Physics.
Every approach to constraining autonomous agents eventually faces the same question: what happens when the constraint is tested?
Zero Trust for Agentic Systems: The Four Dimensions of Trust
AI agents are not users and they are not microservices. They occupy a new category — autonomous software that reasons, acts, and transacts on behalf of human...
Mandates Are Not Blank Checks
When a human buys something online, they click “Purchase.” That click is their consent — implicit, instantaneous, revocable by calling their bank.
Effective Trust and Your Existing Posture
The first question every security leader asks about a new framework: “What happens to what I already have?”
2023
Cybersecurity: Critical Infrastructure Protection: A Reading
This week I had a reading on critical infrastructure policy across the world. While there is a recognition of the importance of critical infrastructure, diff...
Cybersecurity: Protecting Yourself in the Digital Age
Now more than ever in today’s digital age, it’s more important than ever to take steps to protect personal information online. Cyber attacks are becoming inc...
2022
ChatGPT
I was intrigued by the release of ChatGPT for research last week. I set out to explore by putting a few of my questions.
Ted: Building a buisness
An interesting Ted talk that resonated with me a lot. Seemingly complex endeours can indeed be put together using simple concepts.